The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md attempt to override the agent's default interactive behavior by suppressing confirmation prompts. Evidence includes directives to "not stop after findings, propose work instead of doing it, or ask whether to proceed" and to "continue independent work while waiting" for missing information. These directives increase agent autonomy and reduce user oversight during file modification tasks.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a substantial attack surface for indirect prompt injection due to its core function of reading and writing project files. 1. Ingestion Points: The agent is instructed to read various project files, including CONTRIBUTING.md, AGENTS.md, and the entirety of a requested "screen or flow" in the source code. 2. Boundary Markers: The instructions do not define clear boundaries or provide warnings to the agent to ignore instructions found within the audited data. 3. Capability Inventory: The skill has the capability to modify files ("apply all actionable in-scope fixes") and execute project-specific checks or preview commands. 4. Sanitization: There is no requirement for the agent to sanitize or validate the content of the files it processes.

better